-1

I still do not understand the msfvenom format ( -f ) parameter regarding the resulting op codes. I do not understand why a payload consists of different op codes when the format ( -f ) is different, whereas all other parameters stays the same.

Example:

Format is set to python

msfvenom -v -p linux/x86/shell_bind_tcp LPORT=4444 --platform linux -a x86 -f python -e x86/shikata_ga_nai

Attempting to read payload from STDIN...
Found 1 compatible encoders
Attempting to encode payload with 1 iterations of x86/shikata_ga_nai
x86/shikata_ga_nai succeeded with size 27 (iteration=0)
x86/shikata_ga_nai chosen with final size 27
Payload size: 27 bytes
Final size of python file: 144 bytes
-p =  ""
-p += "\xbd\x09\x31\x65\x28\xdb\xcf\xd9\x74\x24\xf4\x5a\x2b"
-p += "\xc9\xb1\x01\x83\xea\xfc\x31\x6a\x0e\x03\x63\x3f\x87"
-p += "\xdd"

Format is set to c

msfvenom -v -p linux/x86/shell_bind_tcp LPORT=4444 --platform linux -a x86 -f c -e x86/shikata_ga_nai
Attempting to read payload from STDIN...
Found 1 compatible encoders
Attempting to encode payload with 1 iterations of x86/shikata_ga_nai
x86/shikata_ga_nai succeeded with size 27 (iteration=0)
x86/shikata_ga_nai chosen with final size 27
Payload size: 27 bytes
Final size of c file: 137 bytes
unsigned char -p[] = 
"\xd9\xc4\xd9\x74\x24\xf4\x58\xbb\x51\x9b\x24\xa8\x2b\xc9\xb1"
"\x01\x83\xc0\x04\x31\x58\x13\x03\x09\x88\xc6\x5d";

As one can see the resulting op codes depending on the format is different.

0

Your command line is wrong because you do not specify the variable name right after inserting -v.

The -v in msfvenom is used to specify custom variable's name. So, according to the order of the options in which you digit, the -p is set to variable name instead of specifying the payload. As you can see on the output generated for both:

python

Final size of python file: 144 bytes
-p =  ""
-p += "\xbd\x09\x31\x65\x28\xdb\xcf\xd9\x74\x24\xf4\x5a\x2b"
-p += "\xc9\xb1\x01\x83\xea\xfc\x31\x6a\x0e\x03\x63\x3f\x87"
-p += "\xdd"

c

Final size of c file: 137 bytes
unsigned char -p[] = 
"\xd9\xc4\xd9\x74\x24\xf4\x58\xbb\x51\x9b\x24\xa8\x2b\xc9\xb1"
"\x01\x83\xc0\x04\x31\x58\x13\x03\x09\x88\xc6\x5d";

The right way to use this flag is -v <shellcode variable name>. i.g., -v shellcode.

  • thanks ... I forgot to define the variable name. But when simply omit the -v parameter I think (although I cannot test it right now) would not explain why the resulting op codes are different. The last op code in the payload in the python format is "\xdd" while in the c format the last op code is "\x5d". If someone can me explain this behavior that truly answer my question. – Dennis1818 Dec 28 '18 at 21:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.